PROBABLY_PENTEST (1) campaign cataloged at 2025-07-05(2).
- Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-07-pipmodule83¶
If run as a module, the package downloads and executes a remote script. At the time of check, the remote script was just opening a popup; thus it's not classified as clearly malicious.
Through the package description related to "cirhenly" package, which was uploaded by "0x92nw" - see campaign 2025-07-0x92nw
Abuse categories¶
remote_script
Downloads and executes a remote malicious script.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://jjjy-9mb.pages.dev/j.vbs -
jjjy-9mb.pages.dev